Loading ToolBench
A transport-agnostic, evidence-carrying policy guard for LLM agents. Guards against prompt injection, PII egress, secrets egress, and injection egress with audit evidence.
Limes is a security policy guard for LLM agents, not a tool-providing MCP server. The two tools (echo, announce) are test fixtures in tests/integration/mcp/http_journal_server.py, not production tools. Both have minimal descriptions (10-20 chars), no parameter descriptions, and schemas with no property descriptions. The echo tool accepts a 'text' parameter with no description of what it does or when to use it. The announce tool has an empty input schema with no guidance. Neither tool documents output structure. This is a guardrail library, not a tool server, evaluating it as an MCP server is a category error, but the test fixtures score poorly by tool quality standards.
Send a server->host log notification, then answer.
Return the text it was given.
Tool descriptions are critically short (10-20 chars). 'Return the text it was given' and 'Send a server->host log notification, then answer' lack context for LLM selection. Baseline: 194 chars average for A+ tools.
Parameter 'text' in echo tool has no description. LLMs cannot infer whether it expects plaintext, markdown, code, or structured data. Baseline: 100% of A+ tools have parameter descriptions.
announce tool has empty input schema (no properties). No guidance on what the tool does, what it returns, or when to call it. Violates pattern:tool requirement for documented input/output.
No output schemas documented for either tool. LLMs cannot plan downstream calls or extract return values. Baseline: 100% of A+ tools have documented return types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 35 | 2026-07-28+ | v2 |
These are test fixtures, not production tools. Limes is a guardrail library; the MCP integration is a proxy transport (transports/mcp/), not a tool server. Evaluating test code as production tools is a scope mismatch.